SMF4 Chief Risk Function: Who Needs It, Independence and CP26/37

The Chief Risk function (SMF4) is the Senior Management Function held by the person with overall responsibility for managing a firm's risk controls. Among FCA solo-regulated firms it applies only to Enhanced firms. At banks, building societies, PRA-designated investment firms and insurers it is a PRA function, though the PRA does not require every firm to have one. SMF4 needs regulatory approval today, and under the FCA's CP26/37 and the PRA's CP14/26 it would stay approved, not notified.

What SMF4 covers

The FCA's SM&CR guide for solo-regulated firms describes SMF4 as the person with overall responsibility for managing the firm's risk controls. The FCA function sits in SUP 10C, the Handbook chapter that lists every senior management function. For banks, the PRA's definition in Senior Management Functions 3.4 is wider: overall management of the firm's risk controls, including setting and managing its risk exposures, and reporting directly to the board on its risk management arrangements. For insurers, Insurance: Senior Management Functions 3.3 ties SMF4 to the risk management system the PRA requires insurers to run.

The holder is usually called Chief Risk Officer or Head of Risk. What defines the role is independence. The CRO runs the second line of defence: the function that sets the risk framework, monitors the business against it and challenges the people who take the risks. A head of credit risk who reports to the CRO does not hold SMF4.

Example: an asset manager with £65bn or more of assets under management, averaged over three years, is an Enhanced firm. Its Chief Risk Officer, who owns the risk appetite framework and reports to the board risk committee, must be approved as SMF4 before taking up the role.

This guide is part of our Senior Management Functions guide.

Which firms need an SMF4

A firm's tier is set by the thresholds on the FCA's categorisation page, which rose by about 30% on 10 July 2026. At dual-regulated firms (supervised by both the PRA and the FCA) the PRA approves the SMF4 and the FCA gives its consent. Banks also face the PRA's Risk Control rules: the head of the risk management function must be an independent senior manager, cannot be removed without the board's prior approval and must be able to go directly to the board.

What the SMF4 holder is personally accountable for

Every SMF4 has a Statement of Responsibilities, the document the regulator holds that lists what this person answers for. For a CRO it normally covers the risk management framework, risk appetite, monitoring and reporting of material risks, and the risk function itself. Our article on statements of responsibilities covers the drafting standard.

Prescribed responsibilities, the specific duties the rules say must be given to a named Senior Manager, relevant to SMF4:

• At Enhanced firms, the FCA's guidance in SYSC 24 names SMF2 or SMF4 as the most likely holder of PR (s), internal stress tests.
• PR (l), safeguarding the independence and overseeing the performance of the risk function, is not meant for the CRO. The FCA expects it to go, where possible, to a non-executive, most likely the chair of the risk committee (SMF10). At banks, PRA PR L expressly covers overseeing the performance of the SMF4.
• At insurers, PR T2, performance of the firm's own risk and solvency assessment (ORSA), can be allocated to the CRO.
• At banks without an SMF4, PR W gives another Senior Manager responsibility for the compliance of the firm's risk management systems.

The Senior Manager Conduct Rules in COCON apply to every SMF4:

• SC1: take reasonable steps to ensure the business you are responsible for is controlled effectively.
• SC2: take reasonable steps to ensure that business complies with the relevant requirements and standards of the regulatory system.
• SC3: take reasonable steps to ensure any delegation is to an appropriate person and that you oversee it effectively.
• SC4: disclose appropriately any information the FCA or PRA would reasonably expect notice of.

The Individual Conduct Rules apply as well: act with integrity, act with due care, skill and diligence, be open and cooperative with the regulators, treat customers fairly, observe proper standards of market conduct and, for retail business, act to deliver good outcomes for retail customers. Since 1 September 2026 the non-financial misconduct rules also apply.

The Duty of Responsibility, in section 66A of FSMA for the FCA and section 66B for the PRA, means that if the firm breaches a requirement in an area the SMF4 is responsible for, the regulator can act against the SMF4 personally unless they took the steps a person in their position could reasonably be expected to take. The regulator has to prove this. For a CRO the practical test is simple: when a risk crystallised, had you seen it, said so and escalated it?

Reasonable steps in practice

The strongest single piece of evidence is a record of disagreement: a dated risk opinion that challenged a decision and what happened next. Our guide to Senior Manager reasonable steps explains how to build the full record.

The first 90 days in the role

• Read your Statement of Responsibilities and confirm it matches the risk committee's terms of reference and the management responsibilities map.
• Obtain a written handover from your predecessor. Enhanced firms must maintain handover procedures.
• Meet the chair of the risk committee alone and agree how and when you can go to the board directly.
• Review the risk appetite framework and test whether each limit is actually measured.
• Read the last year of risk committee minutes, internal audit reports on risk and regulator letters.
• Assess the risk function's people and data, and put any resourcing gaps to the board in writing.
• Agree with the CFO how stress testing and capital planning split between you.

Applying for approval

The firm applies for approval before the person starts, using Form A through Connect, the FCA's online system. At a dual-regulated firm the PRA leads and the FCA consents. Before applying, the firm must satisfy itself that the candidate is fit and proper under FIT: honest, competent and capable, and financially sound. The FCA's preparation guidance expects:

• a criminal records check, which since 24 April 2026 stays valid for six months and is not needed for internal or intragroup moves
• regulatory references from every employer in the last six years
• evidence of competence for the firm's main risks, with a plan for any gaps
• disclosure of directorships in the last ten years and of anything that may affect fitness
• confirmation that the candidate has enough time for the role, and a Statement of Responsibilities

The FCA must decide within three months of receiving a complete application. It has also committed to a two-month standard ahead of a planned change to the law. The FCA names the CRO as one of the roles where candidates at large listed firms are likely to be interviewed. Panels expect candidates to understand their regulatory responsibilities and may explore the firm's business model, risk management, governance and culture. At dual-regulated firms either regulator may interview, and if both do, the interview is joint. Our guide to fitness and propriety covers the assessment itself.

The person must not perform the role before approval, except under the temporary cover rule. Where an SMF4 is absent or leaves unexpectedly, someone can cover for up to 12 weeks. For FCA functions, since PS26/6 the firm must submit (not obtain) the application within those 12 weeks, and the person can then continue until the FCA decides. The PRA's rule for its functions works the same way for reasonably unforeseen absences, provided a valid and complete application is made within the period.

What CP26/37 would change for SMF4

CP26/37 does not make SMF4 a notified role. The FCA keeps it approved, and the PRA lists it as pre-approved in CP14/26. The changes around the role matter more:

• The person who oversees you becomes notified. At dual-regulated and Enhanced firms SMF10, the chair of the risk committee, would be appointed by notification rather than approval, with the same vetting and the same Conduct Rules.
• PR (l) on risk function independence and PR (s) on stress testing would be removed at Enhanced firms, as the FCA keeps only A, D and Z, plus J-3. The FCA says removing a prescribed responsibility does not remove the underlying requirement.
• Group CROs: SMF7 at solo-regulated firms would cover only people with significant influence who also perform a listed group function, and the Chief Risk function is on that list.
• Statements of Responsibilities: no routine resubmission on each change. The firm keeps the statement current, keeps superseded versions for six years and provides it on request.
• Temporary cover: 18 weeks instead of 12. At Enhanced firms a "reasonable use" test would replace "reasonably unforeseen". At banks and insurers the PRA keeps "reasonably unforeseen" for its functions.
• Conditional and time-limited approvals: possible at dual-regulated firms, solo firms in dual-regulated groups and Enhanced firms.
• Tier thresholds: up about 50% for consumer credit lenders, asset managers and intermediaries. A firm that drops to Core no longer has an SMF4 role.

Responses close on 22 January 2027, with final rules expected in the first half of 2027 and changes in force around six months later, subject to the Financial Services and Markets Bill. Our CP26/37 guide covers the full package.

Holding SMF4 with other functions

• SMF4 and SMF16 Compliance Oversight: both are second line roles, so the combination keeps independence intact. The risk is workload, and the firm must show one person can cover both.
• SMF4 and a business line: this is the combination to avoid. The PRA's Risk Control rules require the risk function to be independent from operational functions, and a CRO who runs a revenue line cannot challenge it.
• SMF4 and SMF2: at banks, another senior person may act as head of risk only where the firm's size and complexity do not justify a dedicated appointment and there is no conflict of interest. Combining risk with finance usually fails that test.
• SMF4 and SMF17: possible at smaller Enhanced firms, provided financial crime risk gets enough attention alongside the wider risk agenda.

How we support SMF4 holders

We work with incoming and serving CROs on the regulatory side of the role, so that independence, escalation routes and evidence are clear from the first day. Our SM&CR support covers:

• one-to-one Senior Manager training built on the person's own Statement of Responsibilities
• drafting and review of the Statement of Responsibilities
• the Form A application and the fitness and propriety file
• FCA and PRA interview preparation
• handover arrangements between outgoing and incoming holders